Section 1. Digital security

It is possible to make a film without going anywhere, but it's pretty hard to do so without communicating with anyone. To make your film, you're going to co-ordinate with your team and then some combination of advisors, suppliers, subjects, funders, festivals etc. And unless you opt for having your communications under surveillance, you will need a digital security plan! That's why we've put this section first, to start assessing together whether your communications are sufficiently secure to protect yourself, your subjects, your team and make sure that your important work can reach the public and be as influential as possible.

In short, digital security affects us all and will only become a bigger concern as many governments pass new legislation granting them greater powers. There has never been a better time to start learning about the risk that we are all exposed to and how to protect yourself, your film, subjects and colleagues. Physical danger is often contingent on digital safety.

Note that you may not think at the outset of a project that you need to protect your communications and rushes. But this may become necessary as events unfold, so it's advisable to think ahead and plan for privacy wherever possible.

It's also important to note that technology is constantly changing and is being compromised, so one has to be up to date with the latest tools and what is no longer safe. Information received in a digital safety course taken last year might not be applicable today. It is also critical to know what sort of software or apps are illegal in certain countries as installment in a computer that is then seized could lead to imprisonment. There is no one source to check for regulations, you have to check country by country with reliable local sources.

This following section draw heavily on guides and advice from the Freedom of the Press Foundation, Committee to Protect Journalists, the Rory Peck Trust and Tactical Technology. Links to key resources are included at the end of this and every chapter.

1.1 Assess Your Digital Risk

First things first, consider what you are trying to accomplish with your film project and what it is specifically that you might need to protect (i.e. confidential data, source identities, locations, film footage etc) and the extent of the sensitivities involved.

Take time with your team to think through both the digital security challenges you could be facing throughout the project and how you will communicate and share source material with your team members securely.

As recommended by the Freedom of the Press Foundation, work through what the digital threat model is to your project by assessing who your potential adversaries are, what exactly they would be interested in getting out of you and what would happen to you if they succeeded. Try asking yourself, and others you work with these following questions:

Who would be most likely to target this project?

How much money, time, and skill do they have to dedicate to targeting the project?

What would they most likely want from us (i.e. money? incriminating information? access to my friends or other trusted contacts?)

What would happen to me if they were successful?

From there, look at how you normally communicate, and try to assess where your processes are vulnerable to those specific threats and how you would mitigate against them.

Consider where digital security breaches could occur - not forgetting situations such as working from internet cafes or on computers at business centres of hotels and airports, communicating information on Facebook or Twitter or speaking on a tapped telephone line.

It's important to consider threats that could occur in the process of trying to protect your information in countries where you are filming and gathering information.Also consider threats that may occur in the process of trying to secure your communications. And of course, people are often the greatest risk with regards information leakage. It's always worth being aware of how you communicate with others in person and whether they really need to know the information you are conveying or are being exposed to.

Whether in pre-production, production or postproduction, consider any specific local regulations or operating contexts that may be faced. Depending on the countries you are working in, you may find that use of encryption or the use of a particular digital security tool is actually against the law and so you will need to handle your digital security in another way.

We are recommending digital risk assessment resources you can use from the Rory Peck Trust, Freedom of the Press Foundation and Tactical Technology in the Resources at the end of the section.

Suggested Team Discussion Points:

These questions have been designed to provoke team conversation about the digital risks your production may face. These questions are not exclusive and it is understood that each project has its own bespoke issues that will merit discussion.

Can you currently foresee any reason why you might be targeted for surveillance by national or international government, law enforcement, hackers or corporations?

If yes, why?

What is it you are specifically trying to protect? E.g. confidential data, source identities your location, video footage etc?

Who would be interested in accessing your sensitive information and why? Have they committed a crime, or are they involved in corruption, perpetrate human rights abuses or would the information be damaging or embarrassing in some way?

What methods could they use to get it? Could they access your internet or mobile service provider, hack your device, confiscate your equipment, use a court order, etc.? Could they access devices belonging to your sources or support staff?

What would happen if they succeed at getting it?

Could you or your source or fixer/ translator/ driver (or others) be arrested, could filming be stopped, or could confidential information be used against others?

What are the local regulations on protective software?

Is encryption illegal? Do you need carnets for equipment like sat phones?

Given your responses to these questions, do you need to perform a risk assessment on this project?There are some great resources available for both risk assessment and threat modelling from organisations such as the Rory Peck Trust and the Electronic Frontier Foundation - please see the end of the section for recommendations

1.2 Minimise Your Digital Risk

Of course, each documentary film project has its own bespoke requirements when it comes to safety and security and it's worth considering exactly what steps you and your team need to take to minimise the identified digital security risks. If you are at risk of surveillance:

You will need to avoid being traced by your mobile or sat telephone - but you can remove the battery or buy another burner phone

While paper notepads are digitally secure, they cannot be encrypted and can be confiscated or stolen - so consider this, particularly when on location

Password managers can generate very hard to crack passwords, 1Password comes recommended (read this guide from Freedom of the Press Foundation on improving passwords)

Often sensitive material needs to be communicated in the quickest, most efficient way. Technology is the go to habit, but it's important to be aware of how you communicate certain pieces of information if you do not want it shared by anyone else. Think about also how you will be recording and saving the information from your shoot - will you be traveling with footage across borders that can be compromised? It's important to take a step back as a filmmaker and assess any elements of your story that may need to be protected.

If your project demands it, there are a number of encryption tools that can be deployed to protect aspects of your work by making it unreadable to all except the person who knows how to decrypt it such as:

Using an encrypted form of communication like the mobile (and Chrome plug-in) secure messaging application Signal, an encrypted email like ProtonMail or the one-off encrypted communication, One Time Secret (available in a number of languages). Note that researchers found a vulnerability with PGP email encryption in May, 2018. Digital security experts recommend temporarily disabling PGP plugins for the time being. See the Electronic Frontier Foundation's guide on how to do so here.

Using Freedom of the Press Foundation's Secure Drop to pass files between team members or from sources and subjects.

Implementing a secure web browser such as TOR or those recommended in this article

You should also think about whether your project merits safe technology too, such as working from a clean laptop when in the field and using a burner phone, a prepaid phone bought for a specific purpose and paid for in cash and therefore untraceable.

Carefully consider what your project digital security needs are and then identify the tools that your team need to operate safely.

Suggested Team Discussion Points:

These questions have been designed to provoke team conversation about the risks your production may face. These questions are not exclusive and it is understood that each project has its own bespoke issues that will merit discussion.

Will you, your sources and local support staff (e.g. fixer, translators, drivers) need to use encrypted communications as part of the filmmaking process?

Will you or members of your team need to leave your usual phone behind to avoid being tracked and surveilled?

If this is the case, how will you protect yourself?

Will you need to protect your documents on location and at home?

Should you be encrypting rushes at source on location? Will you be crossing borders? Do you need to encrypt them in your edit room?

1.3 Online Profile Risks

It's crucial to undertake an evaluation of your team's online presence and the profile of your project, both in terms of search engines such as via Google, Yahoo, Bing and others as well as assessing any risks their social media profiles - e.g. on Facebook, LinkedIn, Twitter or any other personal or professional site or network service - may present.

Suggested Team Discussion Points:

Do any search results put you or the film at risk?

Which of the search results could put you at risk on your upcoming assignment? Are any of them under your control?

Do your social media profiles put you or the film at risk?

Does your team's social media presence jeopardise the project in any way? Would it be beneficial to ask them to change their profiles?

Do you or any of your team members have any of your previous work accessible or listed online?

Is that a significant risk to the project?

Should you or your team members be using a different name on location vs what you use for your online presence to protect yourself and your subjects/ sources and their families?

Have you or your team members mentioned this project at all on any social media or blog in the past?

Does this compromise the safety of you and /or your team?

1.4 Experience & Training

Having established what the digital security risks are to your project might be, how knowledgeable are you and your team in understanding how to protect yourselves and your film from methods in which your communications could be compromised?

Before your project heads too far into pre-production, an assessment of your entire team's current level of experience with digital security is highly recommended to ascertain whether formal digital security training would be worthwhile. If there's sensitive material associated with your film project, it's important that anyone involved in communicating about it digitally - whether in the production office or on location - is fully up to speed on the most appropriate methods to be using.

When Things Go Wrong

*(24/7 services are available with support in eight languages: English, Spanish, French, German, Portuguese, Russian, Tagalog, and Arabic. They apparently respond to all requests within two hours)

1.6 Digital Security Training for Filmmakers

We are only putting forward training that we have heard good things about from filmmakers. We want to hear from you if you have taken Digital Security Training that you can recommend to your fellow filmmakers. Email us anytime at: contribute@safeandsecure.film

Freedom of the Press Foundation organise trainings with the IDA and others and also do bespoke training with teams.